CVE-2026-126158: OS Command Injection
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow an authenticated administrator to execute unauthorized code or commands as root via specially crafted HTTP requests.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiMailto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated FortiMail administrator can exploit it. Exploitation requires the ability to send specially crafted HTTP requests to the affected FortiMail interface.
What level of access can exploitation provide?
Successful exploitation may allow execution of unauthorized code or commands as root, with potential impact to confidentiality, integrity, and availability.
Which versions are affected?
Fortinet FortiMail versions 8.0.0 through 8.0.1 are identified as affected.